QuadrigaCX: when only one person has the keys
A crypto exchange says it can’t reach most of its customers’ funds after its founder died. A lesson in key management.
Canadian cryptocurrency exchange QuadrigaCX has asked for creditor protection. It says most of its customers’ funds, well over 100 million Canadian dollars, sit in cold wallets that only its founder could access. The founder died in December.
Whatever else comes out of this story, the basic failure is clear: one person, one set of keys, no plan.
The same thing happens in ordinary companies on a smaller scale. The admin who left with the only password to the firewall. The domain registered on a former employee’s personal account. The backup encryption key nobody wrote down.
What to do:
- List your critical secrets: admin accounts, domains, encryption keys, cloud root accounts.
- Make sure at least two trusted people can reach each one, through a password manager or sealed emergency access.
- Use multi-person approval for the biggest keys where possible.
- Test it: could someone else actually get in tomorrow?